A DevSecOps engineer is configuring automated security testing methods within a continuous integration/continuous deployment (CI/CD) pipeline for a microservices application. Security directives require identifying code flaws before deployment and assessing application security at runtime in a non-production staging environment without attempting intrusive exploitation. Which TWO of the following security testing methods should be integrated to meet these requirements? (Select TWO.)
- Static Application Security Testing (SAST) to analyze uncompiled source code for security flaws early in the build pipeline.Answer
- Dynamic Application Security Testing (DAST) to evaluate running application instances in staging using automated non-intrusive web security scans.Answer
- CInline deception honeypots deployed within production database subnets to intercept and drop malicious application payloads.
- DPerimeter network firewall rules configured to prevent source code buffer overflow flaws within application binaries.
- EDetective access control logs configured as a primary vulnerability scanning technique to discover source code flaws.
Answer
Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) should be integrated into the CI/CD pipeline.
Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) provide complementary vulnerability testing methodologies. SAST analyzes uncompiled code early in the build pipeline to catch static flaws, while DAST tests the compiled, executing application in a staging environment to discover runtime vulnerabilities prior to production release.
Step-by-Step Solution
Key Concept
Vulnerability Assessment and Security Testing Methods in Software Development Lifecycles